1. Who this notice is for
This notice describes how personal information is handled for the MilaHR website and HR service, a product of KRAFTKIN LIMITED (RC 1720148). It applies to website visitors, account contacts and people whose information is held in a customer’s workspace.
An employer or other customer normally decides the purpose and use of the employee information it puts into MilaHR. For that information, the customer is usually the controller and MilaHR acts as a processor under its instructions. KRAFTKIN LIMITED, trading as MilaHR, acts as a controller for its own account administration, billing and direct enquiries. The actual processing arrangement determines these roles.
2. Information involved
Account information may include a name, work email address, company details, account permissions, subscription records and correspondence. Payment details are entered directly with our payment provider, Flutterwave. We receive confirmation of the transaction, the amount, the currency and the last four digits of the card, but not the full card number or security code. Technical records needed to deliver a website or service may include an IP address, browser information and access logs.
Workspace information depends on the employer’s use of MilaHR. It may include employment records, reporting relationships, attendance, leave, onboarding documents, recruitment information, pay records, reviews and exit records. An employer must identify a lawful basis and, where required, a separate condition before adding sensitive information such as health data. Do not include more personal information than the purpose requires.
3. Purposes and lawful bases
The purposes for direct account data are administering the customer relationship, providing support, managing subscriptions, keeping the service secure and meeting legal obligations. Contract necessity applies where the individual is a party to the contract; legitimate interests may support business contact administration and proportionate security activity. Relevant legal duties may require accounting or disclosure records.
Optional marketing would require an appropriate lawful basis and any consent required by local electronic marketing rules. It must offer a way to stop receiving it. No marketing subscription is included in this website implementation. Employee processing follows the employer’s documented purposes and instructions, not a blanket consent obtained through this notice.
4. This website and contact enquiries
The product examples contain illustrative records. The leave preview does not send data or update an employee record. Optional PostHog analytics and tawk.to live chat load only after you accept optional cookies. Your choice is saved in this browser’s local storage; choosing only necessary keeps both services off.
The contact page prepares an email in your email application addressed to hello@milahr.com. The site does not send or store the contents of that form. If you send the email, your email provider and the receiving mailbox handle it. Do not send personnel files, banking information or verification codes through a general enquiry.
You can change your choice by clearing the MilaHR cookie preference in your browser’s site data. Hosting logs and any new form processing must be assessed and described before use. Where optional technologies require consent, they should remain off until that consent is given.
6. Where information is processed
Language and timezone settings do not determine data residency.
Where a transfer is restricted by applicable law, the operator must establish the appropriate transfer mechanism, assess the circumstances and provide the required safeguards. Enterprise residency arrangements must be expressly documented in the customer contract; the website does not promise a particular hosting country.
7. Retention and deletion
Employee record retention is governed by the customer’s instructions and applicable employment, payroll, tax and limitation requirements. Ending employment does not necessarily require immediate deletion of every record.
Direct account and enquiry records should be kept only for as long as needed for their purpose, including relevant legal obligations and disputes.
At the end of service, customer data should be returned or deleted as instructed under the data-processing agreement, subject to lawful retention. Export arrangements, backup expiry and deletion timeframes are governed by that agreement.
8. Protecting information
The service agreement must describe the technical and organisational measures appropriate to the data and risks, including authorised access, confidentiality and incident handling. Independent workspaces help organise access but are not a substitute for a complete security programme.
Do not share sign-in codes. Customers are responsible for assigning appropriate roles and reviewing access when someone changes role or leaves. Specific certifications, encryption implementations, recovery objectives and incident-response commitments should be relied on only when verified in the service documentation or contract.
9. Your choices and rights
Depending on the law that applies, you may have rights to access, correct, erase or restrict personal information, object to certain uses, receive portable data and withdraw consent. These rights have conditions and exceptions; withdrawing consent does not undo processing that was lawful before withdrawal.
For employee records, contact your employer’s HR or privacy team first. MilaHR should assist the controller under the processing agreement rather than independently changing employment records. For KRAFTKIN LIMITED’s own account or enquiry data, email hello@milahr.com. Identity checks should be proportionate to the request.
10. Employment decisions and updates
This website does not make hiring, pay or performance decisions. Employers remain responsible for decisions they make using HR information and for explaining any automated decision-making they introduce, including the safeguards required by applicable law.
We may update this privacy notice as our service or processing arrangements change. Updates will be published on this page with a revised last-updated date. We will identify material changes.